Administration

Generate SAML Metadata So That View Connection Server Can Be Used as a
Service Provider
After you create and enable a SAML authenticator for the identity provider you want to use, you might need
to generate View Connection Server metadata. You use this metadata to create a service provider on the
Access Point appliance or a third-party load balancer that is the identity provider.
Prerequisites
Verify that you have created a SAML authenticator for the identity provider: Access Point or a third-party
load balancer or gateway. In the System Health section on the View Administrator dashboard, you can select
Other components > SAML 2.0 Authenticators, select the SAML authenticator that you added, and verify
the details.
Procedure
1 Open a new browser tab and enter the URL for geing the View Connection Server SAML metadata.
https://connection-server.example.com/SAML/metadata/sp.xml
In this example, connection-server.example.com is the fully qualied domain name of the View Connection
Server host.
This page displays the SAML metadata from View Connection Server.
2 Use a Save As command to save the Web page to an XML le.
For example, you could save the page to a le named connection-server-metadata.xml. The contents of
this le begin with the following text:
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" ...
What to do next
Use the appropriate procedure on the identity provider to copy in the View Connection Server SAML
metadata. Refer to the documentation for Access Point or a third-party load balancer or gateway.
Response Time Considerations for Multiple Dynamic SAML Authenticators
If you congure SAML 2.0 Authentication as optional or required on a View Connection Server instance and
you associate multiple dynamic SAML authenticators with the View Connection Server instance, if any of
the dynamic SAML authenticators become unreachable, the response time to launch remote desktops from
the other dynamic SAML authenticators increases.
You can decrease the response time for remote desktop launch on the other dynamic SAML authenticators
by using View Administrator to disable the unreachable dynamic SAML authenticators. For information
about disabling a SAML authenticator, see “Congure a SAML Authenticator in View Administrator,” on
page 60.
Configure Biometric Authentication
You can congure biometric authentication by editing the pae-ClientConfig aribute in the LDAP database.
Prerequisites
See the Microsoft TechNet Web site for information on how to use the ADSI Edit utility on your Windows
server.
Procedure
1 Start the ADSI Edit utility on the View Connection Server host.
Chapter 4 Setting Up Other Types of User Authentication
VMware, Inc. 63